Securing Real-Time Mobile Communications. Delivering secure mobile access to the cloud. A white paper from Mitel

Size: px

Start display at page:

Download "Securing Real-Time Mobile Communications. Delivering secure mobile access to the cloud. A white paper from Mitel"

Abraham Caldwell
6 years ago
Views:

1 Securing Real-Time Mobile Communications Delivering secure mobile access to the cloud A white paper from Mitel

The workplace itself is changing with employees becoming more mobile and increasingly more distributed. The on-ramp to the Internet is primarily via a smartphone and not a personal computer.

2 The workplace itself is changing with employees becoming more mobile and increasingly more distributed. The on-ramp to the Internet is primarily via a smartphone and not a personal computer. Increasingly, people everywhere would rather communicate and collaborate by text, , social platforms or workstream real-time communications applications. As a result of these dynamics, basic real-time communications and connectivity services delivered by operators are under pressure to evolve as the market demands richer, higher value services available on any device, across any network, at any time. With many options to improve communications and collaboration delivered over LTE networks and the Internet, security and policy enforcement have become an even more critical piece of the equation. For many businesses, best-effort security simply is not sufficient and cannot be an afterthought. As smartphones have changed over time to essentially become mobile computing platforms, these devices are subject to equally evolving security threats. With operators moving the service infrastructure to the cloud, organizations increasingly are concerned about traffic separation and privacy. Few offers in the open market sufficiently satisfy the ever-changing business and functional requirements while also maximizing security, protection, and affordability. Market Dynamics Multiple dynamics are at play in the domain of mobile business communications. While there is a shift in communication modalities, there hasn t yet been a widespread replacement or substitution of one for another. Rather, new styles and means of communicating and collaborating augment and complement the traditional modes of business voice and . Increasingly, the networks that mobile operators build and enable today are and will be done in the cloud. Tier 1 mobile operators today already offer high value real-time communications services across virtualized infrastructure. The move to the cloud and network functions virtualization (NFV)-based architectures presents additional challenges with traffic separation, multi-tenancy, security, privacy, and service orchestration, activation, and management. Primary market dynamics include: 1. The rise of mobile communications as the dominant and preferred medium; 2. The growth (and diversity) of non-voice real-time communications options 1 ; 3. The increased adoption of bring-your-own-device (BYOD) policies in the business environment; 4. Desire by users to have services that coordinate across multiple devices (e.g., smartphone, tablet, and computer); 5. Pressure to maximize business productivity and the use of personally downloaded applications leaking into the business environment are ahead of IT departments setting appropriate policies and procedures; 6. Increased availability and use of Wi-Fi as a primary transport option for services (including Wi-Fi calling and messaging) when in the workplace, at home, and when roaming; 7. A move to services delivered via the cloud by both businesses and mobile network operators; and 8. Security threats becoming more varied and sophisticated. Mobile devices are increasingly subject to hacks and attacks. 1. For example, messaging and workstream collaboration and communication. 2 Mitel

Challenges and Problem Statement Businesses (and the mobile operators that serve them) need to balance dynamic, unpredictable, and often insecure communications methods with security and control.

3 Challenges and Problem Statement Businesses (and the mobile operators that serve them) need to balance dynamic, unpredictable, and often insecure communications methods with security and control. Business managers desire a framework that gives workers full measure of maximizing productivity and efficiency, but need a solution that guarantees end-to-end security across insecure, unregulated and unlicensed environments. Optimally, the solution to the problem is delivered as a software solution without investment in specialized hardware products, supports remote authorization, management, and monitoring, uses standard security protocols and procedures (where practical), accommodates bring-your-owndevice policies, and can be procured via either CapEx or OpEx models. Market Response and Competitive Landscape To date, securing real-time communications at best happens between the end device and the near edge of the mobile network. Once the service request traverses the network boundary into the network core, there s no guarantee to what degree the connecting segments are secured across each segment of the internal network infrastructure 2. A growing number of over-the-top apps 3 find traction with user communities that have a greater awareness of security issues. Peer-to-peer communication via the burgeoning WebRTC technology requires the media to be encrypted. However, these options are typically offered with closed communities, delivered using nonstandard approaches, with no interworking or federation, and are delivered to market by the app provider. Solution Description Mitel presents MiStealth, an offer enabled by Unisys, that delivers valuable, contemporary real-time communications services that are secured end-to-end. Mobile network operators (MNOs) and mobile virtual network operators (MVNOs) bring the solution to market with the primary target segment being organizations that desire a high degree of security for their complete mobile service package. As an example solution enabled by MiStealth, Mitel integrates IMS-based mobile infrastructure solution enabling VoLTE, VoWiFi, and advanced messaging with MiStealth. 2. The 3GPP has specified security requirements for service infrastructure, but not all are fully implemented or deployed. Also, the specifications are available for anyone to consume. 3. Jitsi (recently acquired by Atlassian), Heml.is, RedFone, Secret, Signal, SilentCircle, TextSecure, and Wickr. Mitel 3

4 Real-Time Communications from Mitel The VoLTE/VoWiFi solution by Mitel includes the IMS core (IMC), which interacts with the application voice and messaging application servers, authentication entity, home subscriber service (HSS), and circuitswitched (CS) network via the media gateway control function (MGCF). This is the core component of the IMS solution and all the IMS application servers interact with it as per 3GPP specifications 4. Mitel s IMS solution includes the complete suite of core networking functions as described below. Interrogating Call Session Control Function (I-CSCF): Performs location and routing functions by interrogating the HSS for location and registration information. Serving Call Session Control Function (S-CSCF): Performs session control, feature/service control, registrar service, resource allocation and routing functions. Converged Telephony Application Server (CTAS): Mitel s CTAS is an IR.92/IR.94 compliant application server that provides voice and video services over LTE. Mitel s TAS has been uniquely designed with many standard features found on a GSM/ UMTS MSC such that Mitel s VoLTE/Wi-Fi calling solution provides 100% service parity with the legacy network. Breakout Gateway Control Function (BGCF): Selects the network to which legacy (circuit-switch PSTN) breakout is to occur and provides routing information. Session Border Controller (SBC): Mitel s SBC is used for wireless access from Wi-Fi networks, where mobility is not required or supported (otherwise, Wi-Fi calling-enabled devices connect to the epdg). It also supports VoLTE with esr-vcc functions. Based on a flexible and modular architecture with separately scalable control and media planes, Mitel s SBC functionality is delivered as part of the universal access gateway (UAG). In addition, the UAG provides standard functions like media anchoring, transcoding, media transfer, firewall, and access control functionality. This is the first point of contact for a VoWiFi capable handset into the IMS network. For seamless mobility, the UAG can also host the epdg function. Evolved Packet Data Gateway (epdg): The epdg is used for untrusted Wi- Fi access networks providing secure IPSEC/IKEv2 tunneling and EAP based authentication mechanisms enhancement of the Wi-Fi calling service with seamless mobility by introducing the epdg as part of the EPC network. VoLTE/VoWiFi-enabled devices traverse the epdg to securely connect to the network and seamlessly move between Wi-Fi and LTE access networks without dropping an active voice or video call. Media Resource Function (MRF): The MRF is used in conjunction with the CTAS to provide announcements. It interacts with CTAS on the control plane and interacts with UAG for the media plane. The MRF also provides the media functions required for voice and video conferencing services, as well as other more complex media transcoding for more advanced services. Rich Messaging Service (RMS): Mitel s RMS is the next generation IP messaging platform that can support SMS over IMS functions or OMA CPIM interworking to legacy SMS/MMS. The RMS interconnects with SMSC and proxies SMS messages to/from the mobile subscriber when registered in IMS. The RMS is an IMS application server element which offers SMS services over IP for all VoWiFi subscribers when under Wi-Fi coverage and connects the VoWiFi subscribers to the legacy SMSC to deliver and receive SMS messages. Application Gateway (AG): Mitel s AG performs the security gateway function for HTTP-based traffic from the public Internet to the operator s trusted network, which is needed for authenticating and authorizing HTTP traffic when using the Wi-Fi calling service. A typical use case of AG involvement is user-changing supplementary services over 3GPP Ut interface. The AG authorizes the request and enables supplementary service management over Wi-Fi access. Packet Data Network Gateway (PGW): The PGW does the bearer handing (S2b Interface with the epdg). The PGW also handles the IP mobility anchoring between LTE and Wi-Fi access. It can be optionally combined with the access SBC in an optimized converged architecture. Mobile Client: The Mitel VoWiFi mobile client complies to 3GPP and IETF standards as well as the applicable portions of GSMA IR.92. The client is downloaded on the handset and interacts with the handset components to latch on a Wi-Fi connection and register with the Mitel application servers. Once registered, the Mitel VoWiFi client works seamlessly to offer voice call and messaging services over IP to the end user. Client Configuration and Provisioning Server (CCPS): The CCPS automates provisioning and configuration based on the RCS auto-configuration architecture. This is based on the client performing HTTP requests to a dedicated server that manages configuration data and interacts with customer s IT and network platforms to authenticate and control client behavior. Provisioning Gateway (PG): The PG provides CS service parity and synchronization of a VoWiFi subscriber s configuration upon initial subscription. Ongoing service updates are also supported in the access domain from which the updates were originated. This includes changes applied via the backend provisioning system. The PG operation is seamless to the end user. IMS Home Subscriber Service (IMS-HSS): The IMS-HSS provides the home subscriber service as per IMS 3GPP standard and offers a 3GPP standard interface to the IMS core and application servers for subscriber profile exchange and other functions Voic Application Server (VM AS) and mstore: The VM AS together with mstore provides the voic deposit and notification functions in the solution when subscriber is not reachable, busy or not logged in, etc. 4. The IMS core is interchangeably referred to as CSCF. 4 Mitel

MiStealth Security The MiStealth solution integrates with the Mitel portfolio for operators and enterprises. MiStealth is a security architectural framework which: 1.

5 MiStealth Security The MiStealth solution integrates with the Mitel portfolio for operators and enterprises. MiStealth is a security architectural framework which: 1. Enables IP network segmentation based on user identity. 2. Provides the ability for network endpoints to go dark to be essentially undetectable except to authorized users. 3. Secures data in motion via AES-256 encryption based on ephemeral keys with Perfect Forward Secrecy. 4. Reduces reliance on physical infrastructure for security, allowing consolidation of physical networks and cost reduction. 5. Quickly responds to changing business needs by allowing network access privileges to be controlled through commonly used identity management systems such as Microsoft Active Directory. Each COI has an associated cryptographic key, and each network endpoint receives its COI keys dynamically by presenting user credentials to a MiStealth Authorization Service. The Authorization Service uses an identity management system to authenticate user credentials, and to determine which COI each user is authorized to receive. Secure Community of Interest Protocol (SCIP): The SCIP allows two endpoints to determine if they share a COI, without requiring either endpoint to reveal its COI. SCIP also allows two endpoints to derive an ephemeral shared secret that is then used by the Internet Key Exchange (IKE) protocol to establish an IPsec tunnel between the endpoints. In addition, SCIP allows two endpoints to agree on the most secure cryptographic profile they both support. Endpoints protected by MiStealth are dark. An endpoint will not accept or transmit any unencrypted packets unless it is specifically configured to do so. Similarly, an endpoint will not respond to SCIP negotiation from another endpoint, unless the two endpoints have a common COI. Secure Communities of Interest (COI): In a network secured by MiStealth, endpoints generally cannot communicate unless the users on those endpoints are members of the same COI. Each COI typically is associated with a group of users that has been defined in an identity management system. In this way, a flat network is segmented dynamically into virtual networks, where connectivity or visibility within each virtual network is determined by user and group definitions in the identity management system. Little or no changes are required to the underlying network gear. Further, no changes are required to applications that run within this framework. MiStealth automatically protects endpoints and their network traffic, using COIs and filters to limit allowed traffic based on user-specific and role-specific policies. The entire MiStealth framework is centrally managed, supporting enterprise-wide license pooling. As part of the management system, enhanced monitoring and control of endpoints is supported. Mitel 5

6 The MiStealth solution is comprised of the following key elements: Enterprise Manager (EM): A centrallymanaged, distributed set of component services allow administrators to create and manage various MiStealth objects such as COIs, filters, and roles; to provision and monitor geographically dispersed EM components; and to authorize, monitor, and license MiStealth users. EM components can be deployed in a high-availability configuration. Enterprise Management Portal (EM Portal) is the administrators user interface. It is composed of a series of portlets that administrators use to configure and manage the MiStealth environment. Enterprise Management Core (EM Core) contains the database of MiStealth objects and their attributes. It also hosts the business logic that implements the functions presented in EM Portal, and is an audit repository for all of the MiStealthrelated events within the enterprise. Authorization Service (AuthSvc) distributes COIs and filters to endpoints based on user identity. It also serves as the licensing, logging, and control point for active endpoints. Each endpoint is provisioned with an ordered list of AuthSvcs, and proceeds sequentially through the list until receiving COIs. License Service (LicSvc) maintains a pool of licenses of different types (e.g., server, workstation, mobile), and distributes them to AuthSvcs ondemand. A central pool of licenses can be shared across the entire enterprise, and can dynamically follow the sun as demand shifts across geographies. Monitor Service (MonSvc) interconnects the central and distributed EM components. EM can be deployed either as a full set of all five of these components or as a distributed subset containing an AuthSvc, LicSvc, and MonSvc. One of the full, five-component deployments must be installed somewhere in the enterprise. This full deployment is referred to as an Enterprise Management Server (EMSvr). Subordinate three-component deployments (AuthSvc, LicSvc, and MonSvc), referred to as Authorization Servers (AuthSvrs) can also be deployed throughout the enterprise for redundancy or locality. EM components can be installed on Windows Server 2008 R2 or 2012 R2. EM is distributed as a single image (.iso), which can be installed on either a standalone or virtualized server. EM generates installation packages that are used to install the MiStealth agent on endpoints. Packages are tailored according to the endpoint operating system, the ordered list of AuthSvcs the endpoint should use, and other parameters. Endpoints: Each MiStealth-enabled endpoint has a MiStealth agent. The agent is responsible for communicating with AuthSvcs to authorize users and obtain COIs, claim a license, and log MiStealth-related events. The agent also manipulates the native OS packet filters to remain dark on the network, to perform SCIP negotiation, to establish IPsec tunnels, and to allow or deny specific traffic flows. Endpoint installation packages can be distributed with common software distribution tools, such as Microsoft SCCM, and can be installed silently with no user intervention. MiStealth Secure Virtual Gateway (SSVG): Operating systems for which there is no native MiStealth agent available can participate in MiStealth networks through the use of a SSVG. The SSVG is placed topologically in front of the systems to be protected, with as small a clear-text segment between those systems and the SSVG as possible. Within the SSVG, each protected system is configured with user credentials. The user credentials determine, through the normal MiStealth authorization method, which COI is given to the protected system. Multiple clear-text systems can be protected by one SSVG, each system with its own unique user credentials. The SSVG is packaged as a Linux system image that can be installed on a dedicated physical server, or as a VM in a virtualized environment. Secure Remote Access Gateway (SRA- GW): Systems, devices, or specific mobile applications that need to participate in a MiStealth-protected intranet, but are outside the intranet, can connect through a SRA-GW. As with the SSVG, each remote endpoint is represented as a unique MiStealth endpoint within the intranet. With SRA- GW, unlike SSVG, users are dynamically authenticated instead of being statically configured, and the connection from the remote endpoint to the SRA-GW is a highly secured IPsec VPN tunnel. Remote endpoints can be systems or devices with native IPsec VPN capabilities, or mobile applications that have been wrapped using Mocana MAP. SRA-GW requires an additional component, the IPsec VPN Gateway (VPN-GW), to terminate IPsec tunnels from remote endpoints. The MiStealth Security Gateway from Mitel serves the role of VPN-GW. 6 Mitel

7 MiStealth Benefits Secure Communities of Interest: MiStealth achieves network segmentation dynamically through the use of SCIP, IKE, and IPsec to implement secure communities of interest based on user identity. Endpoints are dark to unauthorized traffic. Software Solution: No hardware appliances are required to deploy a MiStealth-enabled environment. All components are delivered as software and are suitable for executing in virtualized environments or on dedicated server hardware provided by the enterprise or operator. Enterprise Licensing: MiStealth licenses can be pooled for an entire enterprise, with licenses floating to wherever they are required on-demand. Leverage Identity Management Systems: MiStealth enables network access to be managed based on groups defined in commonly used identity management systems such as Microsoft Active Directory. Standard Security Methods and Protocols: Internet Key Exchange (IKE) and IPSec are the underlying key exchange, tunnel establishment and data transfer protocols. The use of these standard protocols improves the performance of endpoints, allows for wider OS platform support, and facilitates wider adoption. Centralized Management: All MiStealth objects, such as COIs, roles, authorization services, and endpoint installation packages are centrally defined, provisioned, and maintained through a web-based portal which can be located anywhere in the network. No Changes to Applications or User Procedures: MiStealth functions automatically and does not require any changes to application code. The MiStealth agent obtains COI keys automatically when a user logs on. Holistic View of Entire Secure Real-Time Mobile Communications Solution Legend Signaling Bearer Air Link SRVCC/ICS ISBC IBCF ENUM HLR BGCF Mj MGCF Authorization Server HTTP SRA VDR Gateway Controller Unisys Stealth Radius VPN Gateway 2G/3G Access R4 Core MSC MGCF SIP IMS-MGW MAP TrGW VoLTE IWF SRVCC HSS Mw/Mj/Mg Cx I-CSCF Mi Mg Mn IMS-MGW S1-MME S1-U enb MME X11 S5/s8 SGW PGW Gx PGW SGI Rx Rx ATCF/ ATGW/ IBCF/ I-SBC/ E-CSCF P-CSCF UAG (Unified Access Gateway) Mw Mw Mx HSS Cx BGCF/SRE Mw S-CSCF Mj LI X1/X2 HSS ENUM Sh TAS SCC-AS Mitel Mobile Ma SC/Mr 2 ENUM ISC ISC ISC AGW Ut Mr 2 CAP DNS Rf SNMP SGI PS RLS IP SM GW (IMP) RMS (RCS) Mp MSC/MGCF MGW MRFP SCP DNS CDF OSS ATGW Rich Message Server (RMS) Mitel 7

8 Solution Differentiation The Mitel solution is unique in the market from the perspective of functionality and value proposition. End-to-End Security Mobile solutions delivered by MNOs typically provide security from the endpoint to the edge of the network core. In an IMS context, the P-CSCF maintains the security association between the endpoint and the network core. However, once inside the core, there is no guarantee how and to what degree traffic is secured. The MiStealth solution provides security along the entire network path from endpoint to endpoint. Portability The solution offers a framework for an enterprise or organization to establish and implement security policies that are associated with a user rather than a device. Roaming Users that travel outside of the operator s coverage area benefit from the solution s ability to provide end-to-end security from the mobile application though all of the segments the service traverses. Beyond Real-Time Communications Should an enterprise or organization wish to encompass a broader set of mobile applications (e.g., , CRM, ERP), the MNO/MVNO can extend the solution scope and provide added value to the solution. Make the Smart Choice Businesses and organizations need to be savvy when they make decisions relating to real-time communications. They must make the best choice in accommodating their workforce s desired communications methods while also ensuring security. Mobile operators need to respond and address the security component of this new wave of services and respond to growing threat of mobile-targeted security breaches. Mobile network operators are also motivated to improve ARPU and to craft truly differentiated offers. The MiStealth real-time communications solution from Mitel delivers on all points. Contact us today to learn more. mitel.com Copyright 2016, Mitel Networks Corporation. All Rights Reserved. The Mitel word and logo are trademarks of Mitel Networks Corporation. Any reference to third party trademarks are for reference only and Mitel makes no representation of ownership of these marks.

Sh Gy. Ro Gx. Cx Ici. Mr Mj

Sh Gy. Ro Gx. Cx Ici. Mr Mj Sh Ro Cx Ici SIP UT IMS Sv LTE Mr Mj Mi Mg ISC Mw LTE / VoLTE IMS Protocols Interfaces LTE Protocol Stack IMS Protocol Stack LTE (4G) IMS PSTN / LTE Ex : S1, S5, SGi LTE Control Plane Ex : S1, S10, S11,